Here's the situation I'm trying to muddle through:
We have a production server that inputs.conf is monitoring, all the files being monitored are in:
[monitor:///log_comp1/scribed/*/*/*.log]
index = production
Then we have a separate qa server that inputs that conf is also monitoring:
[monitor:///logs/scribed/*/*/*.log]
index = qa
The problem I am facing is that it turns out the production log server has a symlink on it for /logs/, which points to /log_comp1/
So, the qa monitoring statement is picking up logs from the production symlink and indexing it in the qa index - basically this stuff is being indexed twice, and it's causing confusion when searching in the qa index, since it throws production data back.
Is there a way to blacklist logs from the production server from being indexed by the qa monitoring statement? The directory names all all the same after /logs/scribed - so I can't use directory names in the blacklist, without accidentally blacklisting qa log data.
Any suggestions?
